CVE-2026-54453 Details

A remote code execution vulnerability has been identified in OpenCATS, an open-source applicant tracking system, prior to version 0.10.0. The issue arises in the Professional License configuration feature within the Settings module, where administrator-controlled license key inputs are improperly handled. The keys are written into the 'config.php' file as PHP 'define()' statements without adequate escaping. Since 'config.php' is included in the application, this flaw can be exploited to execute arbitrary PHP code on the server with the same privileges as the web server process. The vulnerability requires an authenticated administrator with access to the Settings module and permission to modify the Professional License configuration. Additionally, 'config.php' must be writable. Exploitation could lead to unauthorized PHP code execution, allowing access to sensitive application data and the potential for further attacks.

Users can upgrade to OpenCATS version 0.10.0 or later, which addresses this vulnerability by removing the unsafe license key handling in the Professional License management feature. After upgrading, it's recommended to review and adjust the 'config.php' file permissions to prevent write access by the web server user.